Internet users such as individuals and organizations are subject to different
types of epidemic risks such as worms, viruses, spams, and botnets. To reduce
the probability of risk, an Internet user generally invests in traditional
security mechanisms like anti-virus and anti-spam software, sometimes also
known as \emph{self-defense} mechanisms. However, according to security
experts, such software (and their subsequent advancements) will not completely
eliminate risk.
In recent years, researchers have proposed \emph{cyber-insurance} as a
suitable risk-management technique for enhancing security in Internet-like
distributed systems. However, amongst other factors, information asymmetry
between the insurer and the insured, and the inter-dependent and correlated
nature of cyber risks have contributed in a big way to the failure of
cyber-insurance markets.